General

  • Target

    Solara.exe

  • Size

    796KB

  • Sample

    241013-qxk83ayhjg

  • MD5

    e91f3ec430934cf29cda88d9b730d893

  • SHA1

    6453d1f200f568b7964861c683a4f519431a9468

  • SHA256

    4960838a390adf1ea412850ca14f15ce7c201fa967c0089df97742ee517ed0fe

  • SHA512

    cc6afc8a20943ef7d18aaddde9f9257dbd7d0913aeb5ef66734cd593e580ecddde7a0706e4415c202655536b0665ce81116fd5ed487d3311caa10b33fbb7406b

  • SSDEEP

    12288:wyveQB/fTHIGaPkKEYzURNAwbAg/KyEbx/j76eLaOfqPCm+3KP8ps1uZ:wuDXTIGaPhEYzUzA0kyE1jue+AvUG

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:1764

cash-hispanic.gl.at.ply.gg:1764

Attributes
  • Install_directory

    %AppData%

  • install_file

    explorer.exe

  • telegram

    https://api.telegram.org/bot8013268995:AAHt5-BJsAIEM9hnoTy17y1WYC4NnCMU398/sendMessage?chat_id=5405936031

Extracted

Family

gurcu

C2

https://api.telegram.org/bot8013268995:AAHt5-BJsAIEM9hnoTy17y1WYC4NnCMU398/sendMessage?chat_id=5405936031

Targets

    • Target

      Solara.exe

    • Size

      796KB

    • MD5

      e91f3ec430934cf29cda88d9b730d893

    • SHA1

      6453d1f200f568b7964861c683a4f519431a9468

    • SHA256

      4960838a390adf1ea412850ca14f15ce7c201fa967c0089df97742ee517ed0fe

    • SHA512

      cc6afc8a20943ef7d18aaddde9f9257dbd7d0913aeb5ef66734cd593e580ecddde7a0706e4415c202655536b0665ce81116fd5ed487d3311caa10b33fbb7406b

    • SSDEEP

      12288:wyveQB/fTHIGaPkKEYzURNAwbAg/KyEbx/j76eLaOfqPCm+3KP8ps1uZ:wuDXTIGaPhEYzUzA0kyE1jue+AvUG

    • Detect Xworm Payload

    • Gurcu, WhiteSnake

      Gurcu is a malware stealer written in C#.

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Modifies system executable filetype association

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks